Resetting FrameTreeNode must remove child FrameTreeNodes from global map.

content/browser/frame_host/frame_tree_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/frame_tree.h"
 
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "content/browser/frame_host/navigator_impl.h"
 #include "content/browser/frame_host/render_frame_host_factory.h"
@@ skipping 234 matching lines @@
   FrameTreeNode* root = frame_tree->root();
   int process_id = root->current_frame_host()->GetProcess()->GetID();
 
   ASSERT_EQ("1: []", GetTreeState(frame_tree));
 
   // Simulate attaching a frame from mismatched process id.
   ASSERT_FALSE(frame_tree->AddFrame(root, process_id + 1, 1, std::string()));
   ASSERT_EQ("1: []", GetTreeState(frame_tree));
 }
 
+// Ensure that frames removed while a process has crashed are not preserved in
+// the global map of id->frame.
+TEST_F(FrameTreeTest, ProcessCrashClearsGlobalMap) {
+  // Add a couple child frames to the main frame.
+  FrameTreeNode* root = contents()->GetFrameTree()->root();
+
+  main_test_rfh()->OnCreateChildFrame(22, std::string(), SandboxFlags::NONE);
+  main_test_rfh()->OnCreateChildFrame(23, std::string(), SandboxFlags::NONE);
+
+  // Ensure they can be found by id.
+  int64 id1 = root->child_at(0)->frame_tree_node_id();
+  int64 id2 = root->child_at(1)->frame_tree_node_id();
+  EXPECT_TRUE(FrameTree::GloballyFindByID(id1));
+  EXPECT_TRUE(FrameTree::GloballyFindByID(id2));
+
+  // Crash the renderer.
+  main_test_rfh()->OnMessageReceived(FrameHostMsg_RenderProcessGone(
+      0, base::TERMINATION_STATUS_PROCESS_CRASHED, -1));
+
+  // Ensure they cannot be found by id after the process has crashed.
+  EXPECT_FALSE(FrameTree::GloballyFindByID(id1));
+  EXPECT_FALSE(FrameTree::GloballyFindByID(id2));
+}
+
 }  // namespace content